vendor: github.com/klauspost/compress v1.20.1

full diff: https://github.com/klauspost/compress/compare/v1.20.0...v1.20.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

vendor.mod

@@ -87,7 +87,7 @@ require (
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/klauspost/compress v1.20.0 // indirect
+	github.com/klauspost/compress v1.20.1 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/sys/user v0.4.1 // indirect
 	github.com/moby/sys/userns v0.2.1 // indirect

vendor.sum

@@ -78,8 +78,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.20.0 h1:a3C1ke2ohxFymNlb2HWAHjDeKCI90scRskErZkR0ezA=
-github.com/klauspost/compress v1.20.0/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
+github.com/klauspost/compress v1.20.1 h1:T7kKElXUMXrUJ2E9QhQhxFtcK5rPyLdsGZvdbLMPdiQ=
+github.com/klauspost/compress v1.20.1/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/mattn/go-runewidth v0.0.29 h1:3oGF3R/S2N9DQ3ptftzVIvg2eicmojCzlwBEmqEPDfQ=

vendor/github.com/klauspost/compress/huff0/bitreader.go

@@ -9,6 +9,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"math/bits"
 
 	"github.com/klauspost/compress/internal/le"
 )
@@ -210,6 +211,68 @@ func (b *bitReaderShifted) remaining() uint {
 	return b.off*8 + uint(64-b.bitsRead)
 }
 
+// canUseAsm reports whether the reader has a full 8-byte window ahead of
+// its read pointer, which the Decompress4X asm loops need to take over.
+func (b *bitReaderShifted) canUseAsm() bool {
+	return b.off >= 8
+}
+
+// prepareForAsm establishes the invariant the Decompress4X asm loops rely
+// on: value == load64(in[off:off+8]) << bitsRead with bitsRead <= 7, so
+// that a full group of symbols can never shift their sentinel bit out of
+// the container. init leaves bitsRead == 8 when the final byte of the
+// stream is exactly 0x01; that whole byte is consumed, so the same position
+// is the window one byte lower with nothing consumed. Requires canUseAsm.
+func (b *bitReaderShifted) prepareForAsm() {
+	if b.bitsRead >= 8 {
+		b.off--
+		b.value = le.Load64(b.in, b.off)
+		b.bitsRead -= 8
+	}
+}
+
+// restoreFromAsm converts the state left behind by the Decompress4X asm
+// loops back to the invariant the Go code relies on: value holds the 8
+// bytes at in[off:off+8] shifted left by bitsRead, with the low bitsRead
+// bits zero.
+//
+// The asm keeps a sentinel bit in value just below the unread bits, so its
+// trailing zero count is the number of consumed bits. The sentinel is ORed
+// over the lowest bit of the window, which the loop never consumes before
+// re-reading memory, so the window is re-read here too rather than taken
+// from value. The asm reports off as the signed distance from the start of
+// the stream, and it can be negative: a reload always reads a whole 8-byte
+// window, so a stream that is nearly drained ends with up to 7 bytes of the
+// previous stream (or the jump table) below its start inside the window.
+// Those bytes sit below the stream's own bits and count as consumed.
+// Anything further below, or more bits consumed than the stream holds, is
+// corruption.
+func (b *bitReaderShifted) restoreFromAsm() error {
+	off := int(b.off)
+	consumed := uint(bits.TrailingZeros64(b.value))
+	if off < 0 {
+		if off < -7 {
+			return errors.New("corruption detected: stream underrun")
+		}
+		consumed += uint(-off) * 8
+		if consumed > 64 {
+			return errors.New("corruption detected: stream underrun")
+		}
+		off = 0
+	}
+	if off+8 > len(b.in) {
+		return errors.New("corruption detected: stream overrun")
+	}
+	b.off = uint(off)
+	b.bitsRead = uint8(consumed)
+	if consumed >= 64 {
+		b.value = 0
+	} else {
+		b.value = le.Load64(b.in, b.off) << consumed
+	}
+	return nil
+}
+
 // close the bitstream and returns an error if out-of-buffer reads occurred.
 func (b *bitReaderShifted) close() error {
 	// Release reference.

vendor/github.com/klauspost/compress/huff0/decompress_amd64.go

@@ -8,36 +8,99 @@ import (
 )
 
 // decompress4x_main_loop_amd64 is an x86 assembler implementation
-// of Decompress4X when tablelog > 8.
+// of Decompress4X when tablelog > 8, decoding fastSymbols symbols per
+// stream between bit container reloads.
 //
 //go:noescape
 func decompress4x_main_loop_amd64(ctx *decompress4xContext)
 
 // decompress4x_8b_main_loop_amd64 is an x86 assembler implementation
-// of Decompress4X when tablelog <= 8 which decodes 4 entries
-// per loop.
+// of Decompress4X when tablelog <= 8, decoding fast8bSymbols symbols
+// per stream between bit container reloads.
 //
 //go:noescape
 func decompress4x_8b_main_loop_amd64(ctx *decompress4xContext)
 
+// decompress4x_4b_main_loop_amd64 is an x86 assembler implementation
+// of Decompress4X when tablelog <= 4, decoding fast4bSymbols symbols
+// per stream between bit container reloads.
+//
+//go:noescape
+func decompress4x_4b_main_loop_amd64(ctx *decompress4xContext)
+
+// decompress4x_4b_main_loop_bmi2 is the BMI2 twin of decompress4x_4b_main_loop_amd64.
+//
+//go:noescape
+func decompress4x_4b_main_loop_bmi2(ctx *decompress4xContext)
+
+// decompress4x_main_loop_bmi2 is the BMI2 twin of decompress4x_main_loop_amd64.
+//
+//go:noescape
+func decompress4x_main_loop_bmi2(ctx *decompress4xContext)
+
+// decompress4x_8b_main_loop_bmi2 is the BMI2 twin of decompress4x_8b_main_loop_amd64.
+//
+//go:noescape
+func decompress4x_8b_main_loop_bmi2(ctx *decompress4xContext)
+
 // decompress1x_main_loop_amd64 is an x86 assembler implementation
-// of Decompress1X when tablelog > 8.
+// of Decompress1X when tablelog > 8, decoding fastSymbols symbols
+// between bit container reloads.
 //
 //go:noescape
 func decompress1x_main_loop_amd64(ctx *decompress1xContext)
 
-// decompress1x_main_loop_bmi2 is an x86 with BMI2 assembler implementation
-// of Decompress1X when tablelog > 8.
+// decompress1x_8b_main_loop_amd64 is an x86 assembler implementation
+// of Decompress1X when tablelog <= 8, decoding fast8bSymbols symbols
+// between bit container reloads.
+//
+//go:noescape
+func decompress1x_8b_main_loop_amd64(ctx *decompress1xContext)
+
+// decompress1x_4b_main_loop_amd64 is an x86 assembler implementation
+// of Decompress1X when tablelog <= 4, decoding fast4bSymbols symbols
+// between bit container reloads.
+//
+//go:noescape
+func decompress1x_4b_main_loop_amd64(ctx *decompress1xContext)
+
+// decompress1x_main_loop_bmi2 is the BMI2 twin of decompress1x_main_loop_amd64.
 //
 //go:noescape
 func decompress1x_main_loop_bmi2(ctx *decompress1xContext)
 
+// decompress1x_8b_main_loop_bmi2 is the BMI2 twin of decompress1x_8b_main_loop_amd64.
+//
+//go:noescape
+func decompress1x_8b_main_loop_bmi2(ctx *decompress1xContext)
+
+// decompress1x_4b_main_loop_bmi2 is the BMI2 twin of decompress1x_4b_main_loop_amd64.
+//
+//go:noescape
+func decompress1x_4b_main_loop_bmi2(ctx *decompress1xContext)
+
 func decompress4x_main_loop_asm(ctx *decompress4xContext) {
-	decompress4x_main_loop_amd64(ctx)
+	if cpuinfo.HasBMI2() {
+		decompress4x_main_loop_bmi2(ctx)
+	} else {
+		decompress4x_main_loop_amd64(ctx)
+	}
 }
 
 func decompress4x_8b_main_loop_asm(ctx *decompress4xContext) {
-	decompress4x_8b_main_loop_amd64(ctx)
+	if cpuinfo.HasBMI2() {
+		decompress4x_8b_main_loop_bmi2(ctx)
+	} else {
+		decompress4x_8b_main_loop_amd64(ctx)
+	}
+}
+
+func decompress4x_4b_main_loop_asm(ctx *decompress4xContext) {
+	if cpuinfo.HasBMI2() {
+		decompress4x_4b_main_loop_bmi2(ctx)
+	} else {
+		decompress4x_4b_main_loop_amd64(ctx)
+	}
 }
 
 func decompress1x_main_loop_asm(ctx *decompress1xContext) {
@@ -47,3 +110,19 @@ func decompress1x_main_loop_asm(ctx *decompress1xContext) {
 		decompress1x_main_loop_amd64(ctx)
 	}
 }
+
+func decompress1x_8b_main_loop_asm(ctx *decompress1xContext) {
+	if cpuinfo.HasBMI2() {
+		decompress1x_8b_main_loop_bmi2(ctx)
+	} else {
+		decompress1x_8b_main_loop_amd64(ctx)
+	}
+}
+
+func decompress1x_4b_main_loop_asm(ctx *decompress1xContext) {
+	if cpuinfo.HasBMI2() {
+		decompress1x_4b_main_loop_bmi2(ctx)
+	} else {
+		decompress1x_4b_main_loop_amd64(ctx)
+	}
+}

vendor/github.com/klauspost/compress/huff0/decompress_arm64.go

@@ -6,24 +6,47 @@
 package huff0
 
 // decompress4x_main_loop_arm64 is an arm64 assembler implementation
-// of Decompress4X when tablelog > 8.
+// of Decompress4X when tablelog > 8, decoding fastSymbols symbols per
+// stream between bit container reloads.
 //
 //go:noescape
 func decompress4x_main_loop_arm64(ctx *decompress4xContext)
 
 // decompress4x_8b_main_loop_arm64 is an arm64 assembler implementation
-// of Decompress4X when tablelog <= 8 which decodes 4 entries
-// per loop.
+// of Decompress4X when tablelog <= 8, decoding fast8bSymbols symbols
+// per stream between bit container reloads.
 //
 //go:noescape
 func decompress4x_8b_main_loop_arm64(ctx *decompress4xContext)
 
+// decompress4x_4b_main_loop_arm64 is an arm64 assembler implementation
+// of Decompress4X when tablelog <= 4, decoding fast4bSymbols symbols
+// per stream between bit container reloads.
+//
+//go:noescape
+func decompress4x_4b_main_loop_arm64(ctx *decompress4xContext)
+
 // decompress1x_main_loop_arm64 is an arm64 assembler implementation
-// of Decompress1X when tablelog > 8.
+// of Decompress1X when tablelog > 8, decoding fastSymbols symbols
+// between bit container reloads.
 //
 //go:noescape
 func decompress1x_main_loop_arm64(ctx *decompress1xContext)
 
+// decompress1x_8b_main_loop_arm64 is an arm64 assembler implementation
+// of Decompress1X when tablelog <= 8, decoding fast8bSymbols symbols
+// between bit container reloads.
+//
+//go:noescape
+func decompress1x_8b_main_loop_arm64(ctx *decompress1xContext)
+
+// decompress1x_4b_main_loop_arm64 is an arm64 assembler implementation
+// of Decompress1X when tablelog <= 4, decoding fast4bSymbols symbols
+// between bit container reloads.
+//
+//go:noescape
+func decompress1x_4b_main_loop_arm64(ctx *decompress1xContext)
+
 func decompress4x_main_loop_asm(ctx *decompress4xContext) {
 	decompress4x_main_loop_arm64(ctx)
 }
@@ -32,6 +55,18 @@ func decompress4x_8b_main_loop_asm(ctx *decompress4xContext) {
 	decompress4x_8b_main_loop_arm64(ctx)
 }
 
+func decompress4x_4b_main_loop_asm(ctx *decompress4xContext) {
+	decompress4x_4b_main_loop_arm64(ctx)
+}
+
 func decompress1x_main_loop_asm(ctx *decompress1xContext) {
 	decompress1x_main_loop_arm64(ctx)
 }
+
+func decompress1x_8b_main_loop_asm(ctx *decompress1xContext) {
+	decompress1x_8b_main_loop_arm64(ctx)
+}
+
+func decompress1x_4b_main_loop_asm(ctx *decompress1xContext) {
+	decompress1x_4b_main_loop_arm64(ctx)
+}

vendor/github.com/klauspost/compress/huff0/decompress_asm.go

@@ -14,6 +14,10 @@ import (
 // fallback8BitSize is the size where using Go version is faster.
 const fallback8BitSize = 800
 
+// decompress4xContext is the argument block of the Decompress4X asm loops.
+// Go fills every field but decoded and inner; the asm advances ip, and on
+// return leaves each bit reader in the form bitReaderShifted.restoreFromAsm
+// expects.
 type decompress4xContext struct {
 	pbr      *[4]bitReaderShifted
 	peekBits uint8
@@ -21,9 +25,20 @@ type decompress4xContext struct {
 	dstEvery int
 	tbl      *dEntrySingle
 	decoded  int
-	limit    *byte
+	limit    *byte    // stream 0's output pointer must stay below this
+	ilowest  *byte    // start of the input block; no read goes below it
+	ip       [4]*byte // each stream's 8-byte input window, advanced by the asm
+	inner    *byte    // scratch for the asm: the current inner-loop limit
 }
 
+// Symbols decoded per stream between reloads by the 4X asm loops; must
+// match the constants of the same names in _generate/gen.go.
+const (
+	fastSymbols   = 5  // tablelog 9..11
+	fast8bSymbols = 7  // tablelog 5..8
+	fast4bSymbols = 14 // tablelog <= 4
+)
+
 // Decompress4X will decompress a 4X encoded stream.
 // The length of the supplied input must match the end of a block exactly.
 // The *capacity* of the dst slice must match the destination size of
@@ -72,23 +87,55 @@ func (d *Decoder) Decompress4X(dst, src []byte) ([]byte, error) {
 
 	var decoded int
 
-	if len(out) > 4*4 && !(br[0].off < 4 || br[1].off < 4 || br[2].off < 4 || br[3].off < 4) {
+	nSyms := fastSymbols
+	if d.actualTableLog <= 4 {
+		nSyms = fast4bSymbols
+	} else if use8BitTables {
+		nSyms = fast8bSymbols
+	}
+	// The asm writes nSyms bytes per stream per iteration and only re-checks
+	// its bounds between batches of iterations (the batch size is derived
+	// from limit in _generate/gen.go), so stream 0 must stop early enough
+	// that stream 3 (which may be up to 3 bytes shorter than dstEvery)
+	// never writes past the end of out. Every stream needs a full 8-byte
+	// window ahead of its read pointer to enter the loop.
+	if limit := dstEvery - nSyms - 2; limit > 0 && br[0].canUseAsm() && br[1].canUseAsm() && br[2].canUseAsm() && br[3].canUseAsm() {
+		for i := range br {
+			br[i].prepareForAsm()
+		}
 		ctx := decompress4xContext{
 			pbr:      &br,
 			peekBits: uint8((64 - d.actualTableLog) & 63), // see: bitReaderShifted.peekBitsFast()
 			out:      &out[0],
 			dstEvery: dstEvery,
 			tbl:      &single[0],
-			limit:    &out[dstEvery-4], // Always stop decoding when first buffer gets here to avoid writing OOB on last.
+			limit:    &out[limit],
+			// The 6-byte jump table sits below stream 0 inside src, so the
+			// lowest window may reach into it; restoreFromAsm accounts for
+			// bytes below a stream's start. Bounding by src rather than by
+			// stream 0 keeps the asm running about six bytes longer, which
+			// matters for streams with very short codes.
+			ilowest: &src[0],
 		}
-		if use8BitTables {
+		for i := range br {
+			ctx.ip[i] = &br[i].in[br[i].off]
+		}
+		switch nSyms {
+		case fast4bSymbols:
+			decompress4x_4b_main_loop_asm(&ctx)
+		case fast8bSymbols:
 			decompress4x_8b_main_loop_asm(&ctx)
-		} else {
+		default:
 			decompress4x_main_loop_asm(&ctx)
 		}
 
 		decoded = ctx.decoded
 		out = out[decoded/4:]
+		for i := range br {
+			if err := br[i].restoreFromAsm(); err != nil {
+				return nil, err
+			}
+		}
 	}
 
 	// Decode remaining.
@@ -128,18 +175,20 @@ func (d *Decoder) Decompress4X(dst, src []byte) ([]byte, error) {
 	return dst, nil
 }
 
+// decompress1xContext is the argument block of the Decompress1X asm loops.
+// Go fills every field but decoded; the asm advances ip, and on return
+// leaves the bit reader in the form bitReaderShifted.restoreFromAsm expects.
 type decompress1xContext struct {
 	pbr      *bitReaderShifted
 	peekBits uint8
 	out      *byte
-	outCap   int
+	outCap   int // no write reaches out[outCap]
 	tbl      *dEntrySingle
 	decoded  int
+	ilowest  *byte // start of the stream; no read goes below it
+	ip       *byte // the 8-byte input window, advanced by the asm
 }
 
-// Error reported by asm implementations
-const error_max_decoded_size_exeeded = -1
-
 // Decompress1X will decompress a 1X encoded stream.
 // The cap of the output buffer will be the maximum decompressed size.
 // The length of the supplied input must match the end of a block exactly.
@@ -158,25 +207,36 @@ func (d *Decoder) Decompress1X(dst, src []byte) ([]byte, error) {
 	const tlSize = 1 << tableLogMax
 	const tlMask = tlSize - 1
 
-	if maxDecodedSize >= 4 {
+	// The asm decodes whole batches of symbols and only re-checks its
+	// bounds between them, so it needs at least one batch of room (the
+	// output bound rounds nSyms up to 16, see _generate/gen.go) and a full
+	// 8-byte window ahead of the read pointer to enter the loop. It also
+	// needs at most 7 bits consumed on entry so that a batch cannot run
+	// the container dry, which prepareForAsm establishes.
+	decoded := 0
+	if maxDecodedSize >= 16 && br.canUseAsm() {
+		br.prepareForAsm()
 		ctx := decompress1xContext{
 			pbr:      &br,
 			out:      &dst[0],
 			outCap:   maxDecodedSize,
 			peekBits: uint8((64 - d.actualTableLog) & 63), // see: bitReaderShifted.peekBitsFast()
 			tbl:      &d.dt.single[0],
+			ilowest:  &src[0],
+			ip:       &br.in[br.off],
 		}
-
-		decompress1x_main_loop_asm(&ctx)
-		if ctx.decoded == error_max_decoded_size_exeeded {
-			return nil, ErrMaxDecodedSizeExceeded
+		if d.actualTableLog <= 4 {
+			decompress1x_4b_main_loop_asm(&ctx)
+		} else if d.actualTableLog <= 8 {
+			decompress1x_8b_main_loop_asm(&ctx)
+		} else {
+			decompress1x_main_loop_asm(&ctx)
 		}
-
-		dst = dst[:ctx.decoded]
+		decoded = ctx.decoded
 	}
+	dst = dst[:decoded]
 
-	// br < 8, so uint8 is fine
-	bitsLeft := uint8(br.off)*8 + 64 - br.bitsRead
+	bitsLeft := br.remaining()
 	for bitsLeft > 0 {
 		br.fill()
 		if len(dst) >= maxDecodedSize {
@@ -186,7 +246,7 @@ func (d *Decoder) Decompress1X(dst, src []byte) ([]byte, error) {
 		v := d.dt.single[br.peekBitsFast(d.actualTableLog)&tlMask]
 		nBits := uint8(v.entry)
 		br.advance(nBits)
-		bitsLeft -= nBits
+		bitsLeft -= uint(nBits)
 		dst = append(dst, uint8(v.entry>>8))
 	}
 	return dst, br.close()

vendor/github.com/klauspost/compress/zstd/blockdec.go

@@ -240,9 +240,11 @@ func (b *blockDec) decodeBuf(hist *history) error {
 			b.dst[i] = v
 		}
 		hist.appendKeep(b.dst)
+		hist.decoders.consumeSyncLen(len(b.dst))
 		return nil
 	case blockTypeRaw:
 		hist.appendKeep(b.data)
+		hist.decoders.consumeSyncLen(len(b.data))
 		return nil
 	case blockTypeCompressed:
 		saved := b.dst
@@ -487,6 +489,7 @@ func (b *blockDec) decodeCompressed(hist *history) error {
 	}
 	if hist.decoders.nSeqs == 0 {
 		b.dst = append(b.dst, hist.decoders.literals...)
+		hist.decoders.consumeSyncLen(len(hist.decoders.literals))
 		return nil
 	}
 	before := len(hist.decoders.out)

vendor/github.com/klauspost/compress/zstd/decoder.go

@@ -7,8 +7,11 @@ package zstd
 import (
 	"context"
 	"encoding/binary"
+	"errors"
 	"io"
+	"maps"
 	"sync"
+	"sync/atomic"
 
 	"github.com/klauspost/compress/zstd/internal/xxhash"
 )
@@ -20,7 +23,8 @@ import (
 // A decoder can safely be re-used even if the previous stream failed.
 // To release the resources, you must call the Close() function on a decoder.
 type Decoder struct {
-	o decoderOptions
+	// publishedOptions contains the current immutable decoder options.
+	publishedOptions atomic.Pointer[decoderOptions]
 
 	// Unreferenced decoders, ready for use.
 	decoders chan *blockDec
@@ -84,9 +88,10 @@ var (
 func NewReader(r io.Reader, opts ...DOption) (*Decoder, error) {
 	initPredefined()
 	var d Decoder
-	d.o.setDefault()
-	for _, o := range opts {
-		err := o(&d.o)
+	var o decoderOptions
+	o.setDefault()
+	for _, opt := range opts {
+		err := opt(&o)
 		if err != nil {
 			return nil, err
 		}
@@ -99,17 +104,19 @@ func NewReader(r io.Reader, opts ...DOption) (*Decoder, error) {
 	}
 
 	// Initialize dict map if needed.
-	if d.o.dicts == nil {
-		d.o.dicts = make(map[uint32]*dict)
+	if o.dicts == nil {
+		o.dicts = make(map[uint32]*dict)
 	}
 
 	// Create decoders
-	d.decoders = make(chan *blockDec, d.o.concurrent)
-	for i := 0; i < d.o.concurrent; i++ {
-		dec := newBlockDec(d.o.lowMem)
-		dec.localFrame = newFrameDec(d.o)
+	d.decoders = make(chan *blockDec, o.concurrent)
+	for i := 0; i < o.concurrent; i++ {
+		dec := newBlockDec(o.lowMem)
+		dec.localFrame = newFrameDec(o)
+		dec.localFrame.o.dicts = nil
 		d.decoders <- dec
 	}
+	d.publishedOptions.Store(&o)
 
 	if r == nil {
 		return &d, nil
@@ -171,6 +178,9 @@ func (d *Decoder) Reset(r io.Reader) error {
 	d.drainOutput()
 
 	d.syncStream.br.r = nil
+	if d.frame != nil {
+		d.frame.o.dicts = nil
+	}
 	if r == nil {
 		d.current.err = ErrDecoderNilInput
 		if len(d.current.b) > 0 {
@@ -180,8 +190,10 @@ func (d *Decoder) Reset(r io.Reader) error {
 		return nil
 	}
 
+	o := *d.publishedOptions.Load()
+
 	// If bytes buffer and < 5MB, do sync decoding anyway.
-	if bb, ok := r.(byter); ok && bb.Len() < d.o.decodeBufsBelow && !d.o.limitToCap {
+	if bb, ok := r.(byter); ok && bb.Len() < o.decodeBufsBelow && !o.limitToCap {
 		bb2 := bb
 		if debugDecoder {
 			println("*bytes.Buffer detected, doing sync decode, len:", bb.Len())
@@ -193,18 +205,30 @@ func (d *Decoder) Reset(r io.Reader) error {
 		}
 
 		dst, err := d.DecodeAll(b, dst)
-		if err == nil {
-			err = io.EOF
+		if !errors.Is(err, ErrDecoderSizeExceeded) {
+			if err == nil {
+				err = io.EOF
+			}
+			// Save output buffer
+			d.syncStream.dstBuf = dst
+			d.current.b = dst
+			d.current.err = err
+			d.current.flushed = true
+			if debugDecoder {
+				println("sync decode to", len(dst), "bytes, err:", err)
+			}
+			return nil
 		}
-		// Save output buffer
-		d.syncStream.dstBuf = dst
-		d.current.b = dst
-		d.current.err = err
-		d.current.flushed = true
+		// The output does not fit WithDecoderMaxMemory, which caps the total
+		// decoded size when decoding in memory. A Reader follows the
+		// streaming contract, where the option caps the window instead, so
+		// decode this input as a stream after all; the shortcut has not
+		// consumed the reader. Drop the oversized buffer rather than keep it
+		// for reuse.
 		if debugDecoder {
-			println("sync decode to", len(dst), "bytes, err:", err)
+			println("sync decode exceeded max memory after", len(dst), "bytes; streaming instead")
 		}
-		return nil
+		d.syncStream.dstBuf = nil
 	}
 	// Remove current block.
 	d.stashDecoder()
@@ -217,14 +241,16 @@ func (d *Decoder) Reset(r io.Reader) error {
 	// Ensure no-one else is still running...
 	d.streamWg.Wait()
 	if d.frame == nil {
-		d.frame = newFrameDec(d.o)
+		d.frame = newFrameDec(o)
+	} else {
+		d.frame.setOptions(o)
 	}
 
-	if d.o.concurrent == 1 {
+	if o.concurrent == 1 {
 		return d.startSyncDecoder(r)
 	}
 
-	d.current.output = make(chan decodeOutput, d.o.concurrent)
+	d.current.output = make(chan decodeOutput, o.concurrent)
 	ctx, cancel := context.WithCancel(context.Background())
 	d.current.cancel = cancel
 	d.streamWg.Add(1)
@@ -238,13 +264,21 @@ func (d *Decoder) Reset(r io.Reader) error {
 // Options are applied on top of the existing options.
 // Some options cannot be changed on reset and will return an error.
 func (d *Decoder) ResetWithOptions(r io.Reader, opts ...DOption) error {
-	d.o.resetOpt = true
-	defer func() { d.o.resetOpt = false }()
+	if d.current.err == ErrDecoderClosed {
+		return d.current.err
+	}
+	next := *d.publishedOptions.Load()
+	next.dicts = maps.Clone(next.dicts)
+	next.resetOpt = true
 	for _, o := range opts {
-		if err := o(&d.o); err != nil {
+		if err := o(&next); err != nil {
+			next.resetOpt = false
+			d.publishedOptions.Store(&next)
 			return err
 		}
 	}
+	next.resetOpt = false
+	d.publishedOptions.Store(&next)
 	return d.Reset(r)
 }
 
@@ -324,6 +358,8 @@ func (d *Decoder) DecodeAll(input, dst []byte) ([]byte, error) {
 	// Grab a block decoder and frame decoder.
 	block := <-d.decoders
 	frame := block.localFrame
+	o := *d.publishedOptions.Load()
+	frame.setOptions(o)
 	initialSize := len(dst)
 	defer func() {
 		if debugDecoder {
@@ -335,6 +371,7 @@ func (d *Decoder) DecodeAll(input, dst []byte) ([]byte, error) {
 			frame.history.decoders.br.in = nil
 			frame.history.decoders.br.cursor = 0
 		}
+		frame.o.dicts = nil
 		d.decoders <- block
 	}()
 	frame.bBuf = input
@@ -354,20 +391,20 @@ func (d *Decoder) DecodeAll(input, dst []byte) ([]byte, error) {
 		if err = d.setDict(frame); err != nil {
 			return nil, err
 		}
-		if frame.WindowSize > d.o.maxWindowSize {
+		if frame.WindowSize > frame.o.maxWindowSize {
 			if debugDecoder {
-				println("window size exceeded:", frame.WindowSize, ">", d.o.maxWindowSize)
+				println("window size exceeded:", frame.WindowSize, ">", frame.o.maxWindowSize)
 			}
 			return dst, ErrWindowSizeExceeded
 		}
 		if frame.FrameContentSize != fcsUnknown {
-			if frame.FrameContentSize > d.o.maxDecodedSize-uint64(len(dst)-initialSize) {
+			if frame.FrameContentSize > frame.o.maxDecodedSize-uint64(len(dst)-initialSize) {
 				if debugDecoder {
-					println("decoder size exceeded; fcs:", frame.FrameContentSize, "> mcs:", d.o.maxDecodedSize-uint64(len(dst)-initialSize), "len:", len(dst))
+					println("decoder size exceeded; fcs:", frame.FrameContentSize, "> mcs:", frame.o.maxDecodedSize-uint64(len(dst)-initialSize), "len:", len(dst))
 				}
 				return dst, ErrDecoderSizeExceeded
 			}
-			if d.o.limitToCap && frame.FrameContentSize > uint64(cap(dst)-len(dst)) {
+			if frame.o.limitToCap && frame.FrameContentSize > uint64(cap(dst)-len(dst)) {
 				if debugDecoder {
 					println("decoder size exceeded; fcs:", frame.FrameContentSize, "> (cap-len)", cap(dst)-len(dst))
 				}
@@ -380,14 +417,14 @@ func (d *Decoder) DecodeAll(input, dst []byte) ([]byte, error) {
 			}
 		}
 
-		if cap(dst) == 0 && !d.o.limitToCap {
+		if cap(dst) == 0 && !frame.o.limitToCap {
 			// Allocate len(input) * 2 by default if nothing is provided
 			// and we didn't get frame content size.
 			size := min(
 				// Cap to 1 MB.
 				len(input)*2, 1<<20)
-			if uint64(size) > d.o.maxDecodedSize {
-				size = int(d.o.maxDecodedSize)
+			if uint64(size) > frame.o.maxDecodedSize {
+				size = int(frame.o.maxDecodedSize)
 			}
 			dst = make([]byte, 0, size)
 		}
@@ -396,7 +433,7 @@ func (d *Decoder) DecodeAll(input, dst []byte) ([]byte, error) {
 		if err != nil {
 			return dst, err
 		}
-		if uint64(len(dst)-initialSize) > d.o.maxDecodedSize {
+		if uint64(len(dst)-initialSize) > frame.o.maxDecodedSize {
 			return dst, ErrDecoderSizeExceeded
 		}
 		if len(frame.bBuf) == 0 {
@@ -459,7 +496,7 @@ func (d *Decoder) nextBlock(blocking bool) (ok bool) {
 		println("got", len(d.current.b), "bytes, error:", d.current.err, "data crc:", tmp)
 	}
 
-	if d.o.ignoreChecksum {
+	if d.frame.o.ignoreChecksum {
 		return true
 	}
 
@@ -497,7 +534,7 @@ func (d *Decoder) nextBlockSync() (ok bool) {
 			if d.current.err != nil {
 				return false
 			}
-			if d.frame.WindowSize > d.o.maxDecodedSize || d.frame.WindowSize > d.o.maxWindowSize {
+			if d.frame.WindowSize > d.frame.o.maxDecodedSize || d.frame.WindowSize > d.frame.o.maxWindowSize {
 				d.current.err = ErrDecoderSizeExceeded
 				return false
 			}
@@ -546,11 +583,11 @@ func (d *Decoder) nextBlockSync() (ok bool) {
 
 		// Update/Check CRC
 		if d.frame.HasCheckSum {
-			if !d.o.ignoreChecksum {
+			if !d.frame.o.ignoreChecksum {
 				d.frame.crc.Write(d.current.b)
 			}
 			if d.current.d.Last {
-				if !d.o.ignoreChecksum {
+				if !d.frame.o.ignoreChecksum {
 					d.current.err = d.frame.checkCRC()
 				} else {
 					d.current.err = d.frame.consumeCRC()
@@ -656,8 +693,8 @@ func (d *Decoder) startStreamDecoder(ctx context.Context, r io.Reader, output ch
 	defer d.streamWg.Done()
 	br := readerWrapper{r: r}
 
-	var seqDecode = make(chan *blockDec, d.o.concurrent)
-	var seqExecute = make(chan *blockDec, d.o.concurrent)
+	var seqDecode = make(chan *blockDec, d.frame.o.concurrent)
+	var seqExecute = make(chan *blockDec, d.frame.o.concurrent)
 
 	// Async 1: Decode sequences...
 	go func() {
@@ -858,9 +895,9 @@ decodeStream:
 		if err == nil {
 			err = d.setDict(frame)
 		}
-		if err == nil && d.frame.WindowSize > d.o.maxWindowSize {
+		if err == nil && d.frame.WindowSize > d.frame.o.maxWindowSize {
 			if debugDecoder {
-				println("decoder size exceeded, fws:", d.frame.WindowSize, "> mws:", d.o.maxWindowSize)
+				println("decoder size exceeded, fws:", d.frame.WindowSize, "> mws:", d.frame.o.maxWindowSize)
 			}
 
 			err = ErrDecoderSizeExceeded
@@ -940,7 +977,7 @@ decodeStream:
 }
 
 func (d *Decoder) setDict(frame *frameDec) (err error) {
-	dict, ok := d.o.dicts[frame.DictionaryID]
+	dict, ok := frame.o.dicts[frame.DictionaryID]
 	if ok {
 		if debugDecoder {
 			println("setting dict", frame.DictionaryID)

vendor/github.com/klauspost/compress/zstd/framedec.go

@@ -49,13 +49,16 @@ const (
 )
 
 func newFrameDec(o decoderOptions) *frameDec {
+	d := frameDec{}
+	d.setOptions(o)
+	return &d
+}
+
+func (d *frameDec) setOptions(o decoderOptions) {
 	if o.maxWindowSize > o.maxDecodedSize {
 		o.maxWindowSize = o.maxDecodedSize
 	}
-	d := frameDec{
-		o: o,
-	}
-	return &d
+	d.o = o
 }
 
 // reset will read the frame header and prepare for block decoding.

vendor/github.com/klauspost/compress/zstd/fse_decoder_arm64.s

@@ -47,12 +47,10 @@ init_main_loop_condition:
 
 	// Spread symbols
 	// Calculate table step
-	MOVD R0, R8
-	LSR  $0x01, R8, R8
-	MOVD R0, R9
-	LSR  $0x03, R9, R9
-	ADD  R9, R8, R8
-	ADD  $3, R8, R8
+	LSR $0x01, R0, R8
+	LSR $0x03, R0, R9
+	ADD R9, R8, R8
+	ADD $3, R8, R8
 
 	// Fill add bits values
 	SUB  $1, R0, R9

vendor/github.com/klauspost/compress/zstd/seqdec.go

@@ -99,6 +99,29 @@ func (s *sequenceDecs) initialize(br *bitReader, hist *history, out []byte) erro
 	return nil
 }
 
+// consumeSyncLen accounts for n bytes of frame output produced outside
+// decodeSync. maxSyncLen bounds how much the frame may still produce and
+// decodeSyncSimple compares it with the output buffer's slack to decide
+// whether the extended 16-byte copies are safe. Blocks with sequences
+// subtracted their output; raw blocks, RLE blocks and compressed blocks
+// holding only literals did not, so a frame that opened with a raw block
+// overstated its remaining size for every block after it and ran the
+// bounds-exact copies for the rest of the frame.
+//
+// Zero means "no bound" and selects the conservative paths, so a block that
+// meets or exceeds the bound lands there; the frame-size checks in
+// runDecoder reject the excess afterwards.
+func (s *sequenceDecs) consumeSyncLen(n int) {
+	if s.maxSyncLen == 0 {
+		return
+	}
+	if uint64(n) >= s.maxSyncLen {
+		s.maxSyncLen = 0
+		return
+	}
+	s.maxSyncLen -= uint64(n)
+}
+
 func (s *sequenceDecs) freeDecoders() {
 	if f := s.litLengths.fse; f != nil && !f.preDefined {
 		fseDecoderPool.Put(f)

vendor/github.com/klauspost/compress/zstd/seqdec_asm.go

@@ -83,9 +83,10 @@ const errorOverread = 6
 // When the output and literal buffers have compressedBlockOverAlloc (16)
 // bytes of slack past their logical use, the assembly may use extended
 // memory copies that read and write in 16-byte blocks, overrunning the end
-// of a literal run or match by up to 15 bytes. Otherwise it must use the
-// bounds-exact ("safe") copies. This mirrors the analogous, always-dynamic
-// selection in executeSimple below.
+// of a literal run or match by up to 15 bytes; an empty literal run still
+// copies one block, reading and writing the full 16 bytes of slack past
+// its position. Otherwise it must use the bounds-exact ("safe") copies.
+// This mirrors the analogous, always-dynamic selection in executeSimple below.
 //
 // The unsafe copies were disabled in #644 (2022) as a mitigation for a
 // crash, but that crash's root cause — an unguarded bitReader overread that

vendor/modules.txt

@@ -145,7 +145,7 @@ github.com/grpc-ecosystem/grpc-gateway/v2/utilities
 # github.com/inconshreveable/mousetrap v1.1.0
 ## explicit; go 1.18
 github.com/inconshreveable/mousetrap
-# github.com/klauspost/compress v1.20.0
+# github.com/klauspost/compress v1.20.1
 ## explicit; go 1.25
 github.com/klauspost/compress
 github.com/klauspost/compress/fse